NEAS[.]bd4e2a66d4287415277aefe8faa4d4c0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NEAS.bd4e2a66d4287415277aefe8faa4d4c0.exe
Size

232KB
MD5

bd4e2a66d4287415277aefe8faa4d4c0
SHA1

4fcde30aa50129d306430708e595705df1b67a17
SHA256

1eb17fcb0cac4cdbedd759d1b20b76c356f64991588a00d21d63ba54e5cc50ce
SHA512

8c584c4a631b9057ebebc385dfe267c196cbad612c371364fd596a1070c9399c4c9094a16cf03d77af89788f57ba2c01af5ac2719ff2b00bb8d4dd07ab15808c
SSDEEP

6144:t8Zrs8JLQUjrKYbZb+l7ktfzXPXRCSlq6q4x4nghDqaTTHzZb:tGpXjm7ktfz0Slk4GnghDqaP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
sample	vmprotect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.bd4e2a66d4287415277aefe8faa4d4c0.exe

Files

NEAS.bd4e2a66d4287415277aefe8faa4d4c0.exe
.exe windows:4 windows x86

500670908c8b2eb548b380523b4b29fd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub

kernel32

LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

MessageBoxA

Sections

.text
Size: - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp1
Size: 196KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ